apiVersion: constraints.gatekeeper.sh/v1beta1
kind: D8RequiredLabels
metadata:
  name: test
spec:
  enforcementAction: "deny"
  match:
    kinds:
      - apiGroups: ["apps"]
        kinds: ["Deployment"]
      - apiGroups: [""]
        kinds: ["Pod"]
  parameters:
    labels:
      - key: foo
      - key: bar
        allowedRegex: "^[a-zA-Z]+.example.com$"
